Firewalls Don't Stop Dragons Podcast

Carey Parker

A Podcast on Computer Security & Privacy for Non-Techies

  1. 4d ago

    Bossware & Boundaries

    When you’re working for your employer, no matter where you are, you’re on company time, using company equipment. Your employer has a responsibility to protect their assets – not just their equipment and facilities, but their data, as well. That gives employers several reasons to monitor you and any devices you might be using for work – including your mobile phone, potentially. While your rights to privacy are limited, they’re not eliminated. Today I’ll ask Jodi Daniels (Red Clover Advisors) and Jan Rosenfeld (iVerify) to help us understand what personal information might be gathered, how it might be used, and what we should do to protect ourselves. Interview Notes iVerify (Jan Rosenfeld): https://iverify.io/  Red Clover Advisors (Jodi Daniels): https://redcloveradvisors.com/our-team/jodi-daniels/  Microsoft Recall: https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c  WiFi Pineapple: https://shop.hak5.org/products/wifi-pineapple  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:20: Intro 0:01:54: Lingo 0:03:45: Why do employers monitor employees? 0:10:23: What privacy rights do employees have? 0:17:27: How do employers monitor mobile phones? 0:24:07: What can be learned using mobile profiles? 0:30:27: How are laptops monitored? 0:34:31: Can employers monitor encrypted traffic? 0:36:17: What are the privacy risks for computor monitoring? 0:41:41: How else might I be tracked at work? 0:48:05: How might my data be correlated with my colleagues? 0:52:38: What about job applicant privacy? 0:55:59: What happens when I leave a company? 1:02:15: How can we best protect employment data? 1:05:22: How do I handle privacy violations? 1:06:55: Wrap-up 1:10:49: Patron podcast preview 1:11:25: Looking ahead

    1h 12m

  2. May 18

    Download All Your Emails

    In the next phase of withdrawing our email data from the cloud, we’re going to download a complete archive of every email we’ve ever sent. It’s not as easy as it should be, but it’s also not that difficult. I’ll give you an overview in today’s Tip of the Week, but you should read the full blog for detailed steps. In the news: Venmo finally makes transactions private by default; FCC extends software update window for banned routers; Meta employees push back on surveillance; Proton Mail adds post-quantum crypto; turn off ChatGPT ad tracking; AI chatbots giving out people’s real phone numbers; Canada’s updated surveillance bill is still bad; Utah wants to effectively ban anonymous VPN use; LLMs want access to your health records; Microsoft Edge is a poor password manager; Canvas hacked during finals; Chrome installing a 4GB AI model on everyone’s computers. Article Links Venmo privacy finally being fixed eight years after ‘alarming’ fails: https://9to5mac.com/2026/05/11/venmo-privacy-finally-being-fixed-eight-years-after-alarming-fails US: FCC Relaxes Foreign-Made Router Ban to Allow for Security Updates: https://www.infosecurity-magazine.com/news/us-fcc-relaxes-foreign-router-ban Meta employees launch protest against mouse-tracking tech at US offices: https://www.reuters.com/sustainability/society-equity/meta-us-employees-organize-protest-against-mouse-tracking-tech-2026-05-12 Proton Mail introduces post-quantum encryption: https://proton.me/blog/introducing-post-quantum-encryption Turn Off ChatGPT’s New Ad Tracking: https://onlinesafety.substack.com/p/turn-off-chatgpts-new-ad-tracking AI chatbots are giving out people’s real phone numbers: https://www.technologyreview.com/2026/05/13/1137203/ai-chatbots-are-giving-out-peoples-real-phone-numbers Canada’s Bill C-22 Is a Repackaged Version of Last Year’s Surveillance Nightmare: https://www.eff.org/deeplinks/2026/05/canadas-bill-c-22-repackaged-version-last-years-surveillance-nightmare Utah’s New Law Targeting VPNs Goes Into Effect May 6th: https://www.eff.org/deeplinks/2026/04/utahs-new-law-regulating-vpns-goes-effect-next-week A.I. Chatbots Want Your Health Records. Tread Carefully.: https://www.nytimes.com/2026/03/12/technology/personaltech/microsoft-copilot-health-ai-chatbots.html Microsoft Edge security alert: All saved passwords unencrypted: https://proton.me/business/blog/microsoft-edge-passwords-exposed ‘The Biggest Student Data Privacy Disaster in History’: Canvas Hack Shows the Danger of Centralized EdTech: https://www.404media.co/the-biggest-student-data-privacy-disaster-in-history-canvas-hack-shows-the-danger-of-centralized-edtech Chrome silently installs a 4 GB local LLM on your computer: https://www.theregister.com/ai-and-ml/2026/05/07/chrome-silently-installs-a-4-gb-local-llm-on-your-computer/5230893 Tip of the Week: https://firewallsdontstopdragons.com/download-all-emails/  Further Info PG’s Data Protection Authority: https://www.privacyguides.org/en/activism/legal/dpa-directory/  Donate to Session: https://getsession.org/donate  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:07: Intro 0:00:19: News tidbits 0:02:53: News rundown 0:05:21: Venmo finally private by default 0:08:57: Banned router updates extended 0:11:28: Meta employees protest surveillance 0:15:47: Proton Mail gets post-quantum crypto 0:19:44: ChatGPT’s new ad tracking 0:24:37: Chatbots giving our people’s phone numbers 0:28:57: Canada C-22 bill still a privacy nightmare 0:32:49: Utah VPN law delayed 0:40:47: AI wants your health info 0:48:14: Edge decrypts all saved passwords 0:53:40: Canvas hit with ransomware 0:56:08: Chrome silently installs 4GB LLM 1:01:06: Tip of the Week 1:09:28: Patron podcast preview 1:09:55: Looking ahead

    1h 11m

  3. May 11

    Cindy Cohn: Privacy’s Defender

    Cindy Cohn has been on the front lines, defending your digital rights, for three decades. With the Electronic Frontier Foundation (EFF), she has litigated several seminal legal cases that have directly impacted the lives of all Americans. As she retires from her role as Director of the EFF, she’s written a memoir about her time there and documents several of these legal fights called Privacy’s Defender. Today I’ll ask Cindy about the key parts of these cases, how we interpret our rights in the digital realm, and what we can do to ensure a free and open internet. Interview Notes Cindy Cohn: https://www.eff.org/about/staff/cindy-cohn  Privacy’s Defender: https://mitpress.mit.edu/9780262051248/privacys-defender/  Give thanks (donate): https://firewallsdontstopdragons.com/give-thanks-donate/  Clipper Chip: https://en.wikipedia.org/wiki/Clipper_chip  Secure Drop: https://securedrop.org/  Geofence warrants case: https://www.eff.org/press/releases/eff-supreme-court-shut-down-unconstitutional-geofence-searches  404 Media’s FOIA Forum: https://www.404media.co/foia-forum-archive/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:15: Intro 0:01:13: Lingo 0:03:52: What if you had lost the Bernstein case? 0:09:18: What re-ignited the Crypto Wars? 0:13:54: Can we prevent all crime with surveillance? 0:16:37: How do our rights apply in the digital world? 0:21:29: Should national security trump our rights? 0:26:58: Can’t courts handle secret evidence? 0:29:20: How does loss of privacy create a power imbalance? 0:35:02: How does privacy improve democracy? 0:36:54: How to you translate technogy to law? 0:40:49: Are we losing online anonymity? 0:44:13: How important are whistleblowers? 0:47:08: How can we protect privacy from the next crisis? 0:54:24: How do we avoid burnout and keep fighting? 0:57:47: How do we get a federal privacy law? 1:02:37: What’s next for you and the EFF? 1:06:48: Wrap-up 1:08:37: Donate to rights organizations 1:10:27: Patron podcast preview 1:11:05: Looking ahead

    1h 12m

  4. May 4

    Withdraw Your Email Data

    Probably the oldest online data you have – like, still have out there right now – is your emails. Did you have an AOL account? Or email through your internet service provider (ISP)? Statistically speaking, you probably have a Gmail, Yahoo Mail or Outlook (previously HotMail) account. Unless you explicitly closed those accounts or deleted those emails, they’re still there. Emails are less like letters in an envelope and much more like postcards, unless you made a point of encrypting them. So today we’ll start a multi-step process to download that email history so that we can delete the online data before it’s slurped into some AI model training or leaked in a data breach. In other news: Met Police win suit to use live facial recognition; Australian teens work around social media ban; big tech is ignoring your do-not-track signals; Meta threatens to leave New Mexico over AG demands; Meta is training AI on their employees; doctors are using AI to take session notes; Mythos suffers ‘unauthorized access’; AI agent deletes companies databases; and AI is empowering script kiddies. Article Links Challenge over Met Police’s use of live facial recognition lost: https://www.bbc.com/news/articles/cq59x4vv954o Most Australian teens admit the social media ban isn’t working as they try to sidestep age verification blocks with face masks and their parents’ IDs: https://www.yahoo.com/news/articles/most-australian-teens-admit-social-111400429.html Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit: https://www.404media.co/google-microsoft-meta-all-tracking-you-even-when-you-opt-out-according-to-an-independent-audit Meta threatens to pull its apps from New Mexico if forced to make ‘technologically impractical’ changes: https://www.theverge.com/policy/921557/meta-threatens-leaving-new-mexico Meta is tracking employees for AI training data: https://proton.me/business/blog/meta-ai-training-employee-data Why your doctor’s AI recorder can be bad for your health (and privacy): https://this.weekinsecurity.com/why-your-doctors-ai-recorder-can-be-bad-for-your-health-and-privacy Anthropic’s most dangerous AI model just fell into the wrong hands: https://www.theverge.com/ai-artificial-intelligence/916501/anthropic-mythos-unauthorized-users-access-security An AI agent allegedly deleted a startup’s production database: https://mashable.com/article/ai-agent-deletes-data-30-hour-service-outage-pocketos Attack of the killer script kiddies: https://www.theverge.com/ai-artificial-intelligence/915660/mythos-script-kiddies-hackers-attack-cybersecurity-ai Tip of the Week: https://firewallsdontstopdragons.com/withdraw-your-data-email/  Further Info Enable and verify GPC flag: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/  Contact your representatives on Section 702 reforms: https://act.eff.org/action/congress-has-until-april-20-to-take-action-on-702-tell-them-not-to-drop-the-ball  AI doctor privacy newsletter: https://buttondown.com/maiht3k/archive/why-you-should-refuse-to-let-your-doctor-record/  Attack of the Script Kiddies: https://www.theverge.com/ai-artificial-intelligence/915660/mythos-script-kiddies-hackers-attack-cybersecurity-ai  Zero Day Clock: https://zerodayclock.com/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:07: Intro 0:01:07: News bites 0:01:59: News rundown 0:04:17: Met Police win face recognition suit 0:09:10: Australia social media ban update 0:13:16: Google, Meta, Microsoft ignoring GPC 0:20:40: New Mexico AG has demands for Meta 0:26:28: Meta tracking employees to train AI 0:32:36: Doctors using AI to take notes 0:39:45: Mythos unauthorized access 0:43:39: AI agent deletes company databases 0:49:25: Attack of the killer script kiddies 1:02:29: Tip of the Week 1:11:45: Patron podcast preview 1:11:54: Looking ahead

    1h 13m

  5. Apr 27

    The Power of Prophecy

    We have relied on prophets and seers for most of human history, largely because humans are obsessed with the future – specifically their own. But prophecy has often been used to determine or at least influence the future, not just predict it. In her new book, Prophecy, Carissa Véliz explains the power and perils of prediction, from the Oracle of Delphi to modern AI, giving us some much-needed perspective on the dangers of chatbots and the people who are selling them to us as powerful tools that will either save or doom all of humanity. Interview Notes Prophecy: https://www.carissaveliz.com/prophecy  Privacy is Power: https://www.carissaveliz.com/books  The Power of Analogue (TEDx): https://www.youtube.com/watch?v=IvJeUQ9Egnk  How Privacy Can Save Your Life (TEDx): https://www.youtube.com/watch?v=xSPRouBvgFE  Here’s to the Crazy Ones (Steve Jobs): https://www.youtube.com/watch?v=mtftHaK9tYY  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:18: Intro 0:03:07: How is prediction used to determine the future? 0:08:09: Why are humans hard to predict? 0:12:34: What does AI predict about itself? 0:19:24: What are longtermism and effective altruism? 0:25:45: How does rationalism compare to empiricism with AI? 0:30:41: Why do humans believe numbers? 0:34:57: Are prediction markets ethical? 0:38:53: What do you tell policymakers? 0:41:51: How do we resist fear of the future? 0:47:11: Wrap up 0:49:45: Patron podcast preview 0:50:23: Looking ahead

    51 min

  6. Apr 20

    AI’s Promise and Peril

    Artificial Intelligence – in particular, Large Language Models (LLMs) or “chatbots” – are increasing in power at an astonishing pace. In fact, the latest models from Anthropic (Claude Mythos) and OpenAI (ChatGPT 5.4 Cyber) are so good at reading software code and finding vulnerabilities, that their makers have strictly limited initial access to manufacturers of the most popular software so that they have a head start in finding exploitable bugs. But it’s not all doom and gloom. I’ll highlight the promise of this powerful new technology, as well. Article Links Brussels launched an age checking app. Hackers say it takes 2 minutes to break it.: https://www.politico.eu/article/eu-brussels-launched-age-checking-app-hackers-say-took-them-2-minutes-break-it FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database: https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2 Iran built a vast camera network to control dissent. Israel turned it into a targeting tool: https://apnews.com/article/iran-war-security-cameras-surveillance-5f9a1fe5845d94894f3edd50af560d3a Iranian hackers are targeting American critical infrastructure, US agencies warn: https://techcrunch.com/2026/04/07/iranian-hackers-are-targeting-american-critical-infrastructure-u-s-agencies-warn LinkedIn secretly scans 6,000+ browser extensions and fingerprints your device: https://thenextweb.com/news/linkedin-browsergate-extension-scanning-privacy-fingerprint The Pixel Trap: Online Marketing Is a Silent PII Harvesting Machine: https://www.secureworld.io/industry-news/pixel-marketing-pii-harvesting Republican Mutiny Sinks Trump’s Push to Extend Warrantless Surveillance: https://www.wired.com/story/republican-mutiny-sinks-trumps-push-to-extend-warrantless-surveillance India drops proposal to mandate national ID app Aadhaar on smartphones after pushback: https://www.reuters.com/world/china/india-drops-proposal-mandate-national-id-app-aadhaar-smartphones-after-pushback-2026-04-17 What I learned by vibe-coding my own word processor: https://www.fastcompany.com/91528164/claude-code-vibe-code-word-processor On Anthropic’s Mythos Preview and Project Glasswing: https://www.schneier.com/blog/archives/2026/04/on-anthropics-mythos-preview-and-project-glasswing.html Tip of the Week: https://firewallsdontstopdragons.com/ai-promise-peril/  Further Info Support the Internet Archive: https://www.savethearchive.com/authors/ or https://www.savethearchive.com/journalists/  Contact your representatives on Section 702 reforms: https://act.eff.org/action/congress-has-until-april-20-to-take-action-on-702-tell-them-not-to-drop-the-ball  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:08: Intro 0:00:37: Internet Archive needs your help 0:02:00: Router ban update 0:02:33: News rundown 0:05:46: New EU age app has bugs 0:10:46: FBI extracts Signal messages 0:16:33: Iran public cameras hacked by Israel 0:22:46: Iran hackers target US, Israel 0:26:11: LinkedIn scans your devices 0:37:06: TikTok Meta pixel madness 0:43:25: Section 702 on the ropes 0:50:56: India drops ID app mandate 0:53:42: Vibe-coding my own word processor 1:04:07: Schneier on Mythos, Glasswing 1:07:37: Tip of the Week 1:21:59: Patron podcast preview 1:22:24: Looking ahead

    1h 24m

  7. Apr 13

    Identity Resolution

    There are all sorts of things that can be used to identify us online and in the real world, beyond our names, addresses, and phone numbers. But data brokers are desperate to tie all of these unique pieces of information together, building a valuable marketing dossier. It’s become a massive industry – being able to map one supposedly anonymous or pseudonymous piece of data to the a person’s full identity. Today we’ll delve deeply into this shady business with Iesha White and Zach Edwards. Interview Notes Victory Medium (Zach): https://victorymedium.com/  Check My Ads (Iesha): https://checkmyads.org/  TLS fingerprinting: https://fingerprint.com/blog/what-is-tls-fingerprinting-transport-layer-security/  Disable Mobile Ad ID (MAID): https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now  US v Google: https://www.usvgoogleads.com/  IAB (Interactive Advertising Bureau) Transparency & Consent Framework (TCF): https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/  DROP portal: https://privacy.ca.gov/drop/  Remove online data: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/  Apple’s Hide My Email: https://support.apple.com/en-us/105078  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:20: Intro 0:02:22: Learning the lingo 0:03:34: What identifiers are used to track us online? 0:12:00: How else are we being tracked? 0:23:20: How are we tracked in the physical world? 0:31:54: How do brick and mortar stores track us? 0:37:46: What if the data is wrong? 0:43:58: What if I’m okay with targetted ads? 0:49:14: How does my data overlap your data? 0:54:01: Can’t this tracking also be used to stop fraud? 0:58:08: Why can’t we just use contextual ads? 1:05:22: What can we do about this? 1:13:00: What does NOT work to stop tracking? 1:14:10: What’s next for you two? 1:17:43: Wrap-up 1:21:05: Patron podcast preview 1:21:56: Looking ahead

    1h 24m

  8. Apr 6

    Routers Behaving Badly

    The US is planning to ban all foreign-made or foreign-designed home WiFi routers… which is basically all routers. It’s true that many consumer routers are pretty crappy when it comes to security. TP-Link just fixed some bad vulnerabilities (which you need to patch ASAP). But what does this mean for anyone wanting to upgrade to a new router? I’ll try to explain. In other news: Walmart is buying TV-maker Vizio to gain access to user data and ads; a company is turning public Zoom meetings into AI podcasts for profit (without permission); a health company suffers a data breach exposing millions of clients’ information; H&R Block’s latest business tax prep software commits an egregious security mistake; AI companies are rolling out dangerous automation features; macOS 26.4 appears to block ClickFix-style attacks; and Facebook and Google lose in a landmark legal case. Article Links Walmart buying TV-brand Vizio for its ad-fueling customer data: https://arstechnica.com/gadgets/2024/02/walmart-buying-tv-brand-vizio-for-its-ad-fueling-customer-data This Company Is Secretly Turning Your Zoom Meetings into AI Podcasts: https://www.404media.co/this-company-is-secretly-turning-your-zoom-calls-into-ai-podcasts This Massive Data Breach Leaked 2.7 Million Social Security Numbers: https://lifehacker.com/tech/navia-data-breach-social-security-numbers These critical exploits just exposed a bigger problem with TP-Link routers: https://www.makeuseof.com/tp-link-critical-exploits-expose-bigger-security-concerns H&R Block’s Tax Prep Blunder: What You Must Know About the 2025 Certificate Vulnerability: https://twit.tv/posts/tech/hr-blocks-tax-prep-blunder-what-you-must-know-about-2025-certificate-vulnerability This New Claude Feature Can Automate Basically Everything on Your Mac, but It’s a Huge Security Risk: https://lifehacker.com/tech/claude-computer-use-impressions The United States router ban, explained: https://www.theverge.com/tech/899906/fcc-router-ban-march-2026-explainer macOS 26.4 warning about potentially malicious Terminal commands: https://appleinsider.com/articles/26/03/26/macos-264-warning-about-potentially-malicious-terminal-commands Meta, Google lose US case over social media harm to kids: https://www.reuters.com/legal/litigation/jury-reaches-verdict-meta-google-trial-social-media-addiction-2026-03-25 Further Info Freeze Your Credit: https://firewallsdontstopdragons.com/credit-freeze-now-is-the-time/  Security Now on H&R Block fiasco: https://youtu.be/JebKuiHu5mg?si=EuXRT9PeKLl1l3oT&t=701  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:07: Intro 0:01:03: News rundown 0:03:17: Walmart buys Vizio for ads, data 0:08:57: Public Zoom calls secretly turned into podcasts 0:17:24: Navia leaks millions of SSNs 0:20:28: TP-Link router vulnerabilities 0:36:25: H&R Block’s horrific tax software 0:45:41: New Claude Mac feature is too dangerous 0:48:22: macOS 24 blocks ClickFix? 0:50:44: Facebook, Google lose huge lawsuit 0:54:22: Patron podcast preview 0:54:58: Looking ahead

    56 min
See All (482)

4.9
out of 5
67 Ratings

About

A Podcast on Computer Security & Privacy for Non-Techies

Information

You Might Also Like